SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.
This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment.
Here are this week’s highlights:
Developers say Log4j vulnerability alert overblown
An Apache Log4j 2 vulnerability raised concerns in the cybersecurity community this week. Reports started circulating about a critical remote code execution vulnerability. However, Log4j developers calmed fears, describing the issue as a “known security non-finding”. They confirmed its potential for remote code execution, but pointed out the specific circumstances required for exploitation and noted that volunteers’ limited time can be spent on more useful things. Log4j vulnerabilities can have a serious impact, as demonstrated by the Log4Shell flaw a few years ago.
U.S. Bank responds to ransomware gang’s claims
U.S. Bancorp says ransomware claims involving its name actually stem from a potential incident at a fourth-party provider, outside the bank’s environment. The bank says there is currently no evidence its systems, networks or data repositories were compromised, although LockBit has threatened to publish allegedly stolen data.
Cybersecurity firm Minimus shuts down
Hardened container image provider Minimus is winding down operations after raising $51 million in 2025, saying the business and investment climate left it unable to continue. The shutdown comes less than a month after the company appeared at the Black Hat conference. Shortly after Minimus announced it was winding down operations, Echo said it acquired the company and its technology.
Credential leak research
A Truffle Security study found over 700 still-active corporate AWS keys that granted full control over their accounts. The discovery was made during the review of 10,616 AWS keys exposed between 2022 and 2026. Separately, Intruder found 28,000 exposed Git repositories while scanning 3.5 million active hosts, uncovering more than 400 AWS keys, 107 Stripe keys, 123 OpenAI keys, 80 Telegram tokens and 17 GitHub PATs. Some credentials were still active and could provide access to cloud environments, private source code and other sensitive systems.
Mobile banking malware widens its reach
Zimperium found 30 mobile malware families actively targeting more than 800 banking and fintech apps across 44 EMEA countries. The research also shows attackers increasingly using AI across the attack chain, from localized lures and exploit scripting to more convincing phishing pages and overlays.
Carhartt breach data was partly fake
Troy Hunt found that a large portion of the data attributed to the alleged Carhartt breach was actually synthetic TPC-DS benchmark data mixed with genuine customer information. His analysis suggests roughly half of the 24.8 million email addresses were junk records, meaning the original ShinyHunters breach claims significantly overstated the amount of real customer data involved.
Paylogix breach exposes sensitive records
Paylogix says attackers stole files from its network over several days in November, exposing Social Security numbers, financial and health insurance information, medical data, passport numbers and taxpayer IDs. At least 67,789 people have been reported affected across South Carolina, New Hampshire and Vermont. The Akira ransomware group took credit for the attack.
Russian cyber training pipeline exposed
Leaked Bauman University records reveal a long-running program that trained roughly 250 career and reserve students for Russian military intelligence and cyber operations. The material covers offensive and defensive cyber techniques, malware analysis, intelligence work and military placements, with graduates linked to units associated with the Russian threat groups APT28 and Sandworm.
Manchester Airports Group cyberattack
Hackers accessed personal data belonging to about 8.7 million customers of Manchester Airports Group, including email addresses, phone numbers, vehicle registrations and postcodes. The attackers demanded a ransom for the return of the data, but MAG refused to pay. The company said airport operations, passenger safety and aviation security were not affected.
US sanctions Iranian hackers
The US Treasury sanctioned Iranian cyber actors tied to the MOIS, accusing the group of compromising critical infrastructure and conducting financially motivated cyber theft. Treasury said Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh and Mohammad Reza Kadkhoda’i carried out compromises and data theft, while four of the 17 Iranian cyber actors charged by the FBI were designated in the action.
Related: In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities
Related: In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug
